Knowledge + Practice

Splunk Core Certified Power User SPLK-1003 (SPLK-1003) — Questions 151–225

500 questions total · 7pages · All types, answers revealed

Take a mock exam Exam hub

Page 3 of 7

151

MCQhard

Refer to the exhibit. The search returns 50 results after the `where` command. What is the purpose of the `eval` command?

A.To filter out results with count ≤ 100.

B.To modify the 'count' field.

C.To rename the 'count' field to 'severity'.

D.To create a new field 'severity' based on a condition.

AnswerD

`eval` with `if()` creates a new field 'severity' that is 'high' if count > 100, else 'low'.

Why this answer

The `eval` command in Splunk is used to create new fields or evaluate expressions. In this context, the `eval` command creates a new field called 'severity' by evaluating a conditional expression that assigns a value based on the 'count' field. This is confirmed by the search returning 50 results after the `where` command, meaning the `eval` command does not filter results but instead adds a computed field.

Exam trap

The trap here is that candidates often confuse `eval` with `where` or `rename`, thinking `eval` can filter or rename fields, when in fact `eval` only creates or modifies fields without affecting the result set or field names directly.

How to eliminate wrong answers

Option A is wrong because the `eval` command does not filter results; filtering is done by the `where` command, which already returned 50 results. Option B is wrong because the `eval` command does not modify the existing 'count' field; it creates a new field 'severity' without altering 'count'. Option C is wrong because the `eval` command does not rename fields; renaming is done using the `rename` command, and the syntax shown creates a new field, not a rename.

Full explanation →

152

MCQhard

An organization uses Splunk to monitor network traffic. They have a CIDR lookup file that maps IP ranges to departments. When they run a search using `| lookup cidr_lookup IP OUTPUT department`, some IP addresses do not return a department even though the IPs are within the defined ranges. What is the most likely issue?

A.The lookup definition is not configured as a CIDR type

B.The IP addresses in the events are in lowercase

C.The lookup file is not in CSV format

D.The lookup file is compressed and not being read correctly

AnswerA

CIDR lookups must be defined with type=cidr in transforms.conf.

Why this answer

The most likely issue is that the lookup definition is not configured as a CIDR type. In Splunk, a standard lookup performs exact string matching, so it will not correctly match an IP address against a range defined in a CIDR notation (e.g., 10.0.0.0/24). To enable range-based matching, the lookup definition must be explicitly set to 'CIDR' type in transforms.conf, which allows Splunk to evaluate whether the IP falls within the specified subnet.

Without this configuration, the lookup will fail to return a department for IPs that are within the defined ranges.

Exam trap

The trap here is that candidates often assume a lookup file with CIDR ranges will automatically work for IP matching, but Splunk requires an explicit configuration change to enable CIDR-based matching instead of exact string matching.

How to eliminate wrong answers

Option B is wrong because IP addresses in Splunk events are case-insensitive strings, and CIDR lookups treat them as text; lowercase does not affect matching. Option C is wrong because Splunk supports lookup files in CSV, KV store, and other formats, and a CIDR lookup file can be in CSV format as long as the definition is correctly configured. Option D is wrong because Splunk can read compressed lookup files (e.g., .csv.gz) without issue, and compression does not prevent CIDR matching if the definition is properly set.

Full explanation →

153

MCQhard

A lookup table file contains 10GB of data. When performing a lookup using the lookup command, search performance is extremely slow. Which approach will most effectively improve performance without losing functionality?

A.Split the lookup into multiple smaller files and use a chain of lookups.

B.Use the inputlookup command to load the entire table into memory.

C.Set the max_memtable_bytes in limits.conf to increase memory.

D.Create a time-based lookup with limited time range.

E.Convert the lookup to a KV store lookup.

AnswerE

KV store lookups are optimized for large datasets and provide faster lookups compared to file-based lookups.

Why this answer

Option A is correct because converting to a KV store lookup uses a more efficient storage and retrieval mechanism, ideal for large lookup tables. Options B, C, D, and E are less effective or reduce functionality.

Full explanation →

154

MCQeasy

Which command extracts a field named 'ip' from the raw event using a regex pattern?

A.rex "ip=(?\d+\.\d+\.\d+\.\d+)"

B.rex "ip=(?<ip>\d+\.\d+\.\d+\.\d+)"

C.rex field=_raw "ip=(?P<ip>\d+\.\d+\.\d+\.\d+)"

D.rex field=_raw "ip=(?<ip>\d+\.\d+\.\d+\.\d+)"

AnswerB

This uses a valid named group and defaults to _raw, correctly extracting the IP field.

Why this answer

Option B is correct because the `rex` command uses the named capture group syntax `(?<ip>...)` to extract a field named 'ip' from the raw event. The pattern `(?<ip>\d+\.\d+\.\d+\.\d+)` matches an IPv4 address and assigns it to the field 'ip'. By default, `rex` operates on the `_raw` field, so no explicit `field=_raw` is needed, and the syntax `(?<name>...)` is the correct Splunk named capture group syntax.

Exam trap

Splunk often tests the distinction between Splunk's `(?<name>...)` syntax and other regex flavors like Python's `(?P<name>...)` or invalid syntax like `(?name...)`, leading candidates to choose options with `?P` or missing angle brackets.

How to eliminate wrong answers

Option A is wrong because the capture group syntax `(?\d+...)` is invalid; Splunk requires a named capture group with angle brackets, like `(?<ip>...)`, to extract a field. Option C is wrong because it uses `(?P<ip>...)`, which is Python-compatible regex syntax, not Splunk's `(?<ip>...)` syntax; Splunk does not support `?P` for named groups. Option D is wrong because, although it correctly uses `(?<ip>...)` and specifies `field=_raw`, the `rex` command defaults to `_raw` anyway, so the explicit field specification is redundant but not incorrect; however, the question asks for the command that extracts the field, and D is technically valid but not the most concise or typical answer, and the exam expects the simpler form without `field=_raw`.

Full explanation →

155

MCQeasy

A saved search is configured with a schedule but is not triggering at the expected time. The admin checks the "Job Inspector" and sees that the scheduled search is "skipped". What is a common reason for a scheduled search to be skipped?

A.The search time range exceeds the bucket's time range

B.There are too many concurrent searches scheduled

C.The search is configured as a real-time search

D.The search string has a syntax error

AnswerB

Correct: This is a common reason for scheduled searches being skipped.

Why this answer

Option C is correct: Splunk can skip scheduled searches if there are too many concurrent searches due to scheduling limits. Option A would cause failure, not skip. Option B might cause search to take longer but not skip.

Option D real-time searches are not scheduled.

Full explanation →

156

MCQeasy

An analyst wants to correlate events from two different sourcetypes: `auth` logs (login events) and `app` logs (application actions). Both logs share a common `session_id` field. The analyst needs to group all events from the same session, regardless of sourcetype, with a maximum time span of 1 hour. Which search correctly uses the `transaction` command?

A.index=main (sourcetype=auth OR sourcetype=app) | transaction by session_id maxspan=1h

B.index=main (sourcetype=auth OR sourcetype=app) | stats values(*) by session_id, _time

C.index=main (sourcetype=auth OR sourcetype=app) | transaction session_id maxspan=1h

D.index=main sourcetype=auth | append [search index=main sourcetype=app] | transaction session_id maxspan=1h

AnswerC

Correctly groups events by session_id with a 1-hour maxspan.

Why this answer

Option C is correct because the `transaction` command groups events that share a common `session_id` field, and the `maxspan=1h` parameter restricts the transaction to a maximum time span of 1 hour. The syntax `transaction session_id maxspan=1h` is valid and ensures all events from both sourcetypes (`auth` and `app`) are correlated into sessions based on the shared field, regardless of sourcetype.

Exam trap

Splunk often tests the subtle syntax difference between `transaction` and `transaction by` — candidates mistakenly add `by` as if it were a `stats` command, but `transaction` takes fields directly without a `by` clause.

How to eliminate wrong answers

Option A is wrong because `transaction by session_id` uses incorrect syntax; the `transaction` command does not accept a `by` clause — it directly takes the field name(s) as arguments. Option B is wrong because `stats values(*) by session_id, _time` does not create transactions; it merely aggregates field values without grouping events into sessions or enforcing a time span. Option D is wrong because using `append` is unnecessary and inefficient; the base search already retrieves both sourcetypes, and `append` does not improve correlation — it simply concatenates results, and the `transaction` command would still work but with redundant overhead.

Full explanation →

157

MCQhard

A Splunk admin notices that a transaction search using the transaction command takes a long time and consumes high memory. The search correlates events by a high-cardinality field (IP address) across multiple indexers. Which optimization technique should be applied first?

A.Use the fields command to remove unnecessary fields before the transaction.

B.Increase maxevents to capture more events per transaction.

C.Use the keepevicted option to retain incomplete transactions.

D.Use the local parameter to force local processing.

AnswerA

Correct: reducing fields lowers memory per event.

Why this answer

Option C is correct because using the fields command to remove unnecessary fields before the transaction reduces memory and processing. Option A (local) limits to one indexer, reducing parallelism and potentially increasing time. Option B (increasing maxevents) would increase memory.

Option D (keepevicted) does not optimize performance.

Full explanation →

158

MCQmedium

Refer to the exhibit. What is the purpose of this search?

A.To compare two datasets and show only matching server names.

B.To update the lookup file with current status.

C.To find servers that are missing from the lookup.

D.To enrich the server list with current status from the main index.

AnswerD

The left join adds current_status to each server from the lookup.

Why this answer

The search uses `inputlookup` to load a lookup file (server_list), then pipes it into `eval` to create a `status` field set to 'missing'. The `append` command adds all events from the main index (source=main sourcetype=access_combined) that match the server names in the lookup. The `stats values(*) as * by server` merges the two datasets per server, so if a server from the lookup has matching events in the main index, its `status` field will be overwritten with the actual status from the main index (e.g., '200').

Servers with no matching events retain 'missing'. This enriches the lookup data with current status from the main index.

Exam trap

The trap here is that candidates may think `append` is used for comparison or filtering (like `join`), but it simply adds events, and the `stats` command with `values()` is what merges and enriches the data, not a direct comparison or update operation.

How to eliminate wrong answers

Option A is wrong because the search does not compare two datasets for matching server names; it uses `append` and `stats` to merge data, not to filter only matching names. Option B is wrong because the search does not include an `outputlookup` command to write results back to the lookup file; it only displays the enriched results. Option C is wrong because the search starts with all servers from the lookup and then adds events from the main index; it does not identify servers missing from the lookup—instead, it marks servers missing from the main index with 'missing' status.

Full explanation →

159

MCQmedium

A search uses eventstats to add the average response time per server to each event. Which of the following correctly describes the output?

A.Each event retains its original fields and gains the average response time for its server.

B.Only one event per server is returned, showing the average response time.

C.A running average is calculated across all events.

D.Events are grouped by server and the top values are listed.

AnswerA

eventstats adds aggregate statistics without reducing the number of events.

Why this answer

The `eventstats` command in Splunk computes aggregate statistics (like average) over a specified field grouping and then appends the result to every original event, not just one per group. In this case, it calculates the average response time per server and adds that value as a new field to each event that belongs to that server, preserving all original fields and events.

Exam trap

Splunk often tests the distinction between `eventstats` and `stats` — the trap here is that candidates confuse `eventstats` with `stats` and assume it collapses events, or they confuse it with `streamstats` and think it calculates a running average.

How to eliminate wrong answers

Option B is wrong because `eventstats` does not reduce the number of events; it returns all original events, each enriched with the aggregate value, unlike `stats` which collapses events into one per group. Option C is wrong because `eventstats` with a `BY server` clause calculates the average per server group, not a running average across all events (which would require `streamstats` or no `BY` clause). Option D is wrong because `eventstats` does not sort or list top values; it simply adds the computed aggregate to each event without reordering or filtering.

Full explanation →

160

MCQmedium

A security analyst wants to find all events where the field 'src_ip' matches any IP address in a lookup table named 'malicious_ips.csv'. The lookup has fields 'ip' and 'threat'. Which search correctly enriches events with the threat info and filters to only malicious IPs?

A.`index=security | lookup malicious_ips.csv src_ip | search threat=*`

B.`index=security | lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""`

C.`index=security [| inputlookup malicious_ips.csv | fields ip | rename ip as src_ip]`

D.`index=security | lookup malicious_ips.csv src_ip AS ip | where isnotnull(threat)`

E.`index=security | lookup malicious_ips.csv src_ip AS ip OUTPUTNEW threat | where isnotnull(threat)`

AnswerE

Correct: uses lookup with outputnew to add threat field, then filters where threat is not null.

Why this answer

Option E is correct because it uses the `lookup` command with `OUTPUTNEW threat` to add the threat field only for matching src_ip values, and then `where isnotnull(threat)` filters to events that actually matched, ensuring only events with a known malicious IP are retained. The `OUTPUTNEW` clause is critical here as it only populates the threat field when a match occurs, unlike `OUTPUT` which would overwrite existing values.

Exam trap

The trap here is that candidates often confuse `OUTPUT` with `OUTPUTNEW` or forget that `where threat!=""` does not catch null values, leading them to pick options that either fail to enrich or fail to filter correctly.

How to eliminate wrong answers

Option A is wrong because `search threat=*` after a lookup without `OUTPUT` will not filter correctly—it would include events where threat is literally an asterisk or fail to filter nulls properly, and the lookup syntax is missing the `OUTPUT` clause to bring in the threat field. Option B is wrong because `where threat!=""` uses an empty string check, but if the lookup fails to match, the threat field may not exist at all (null), not an empty string, so this condition would not reliably filter unmatched events. Option C is wrong because it uses a subsearch with `inputlookup` to generate a list of IPs, but this only filters events where src_ip is in the list—it does not enrich events with the threat field, which the question requires.

Option D is wrong because `lookup malicious_ips.csv src_ip AS ip` incorrectly renames src_ip to ip before matching, which would look for a field named 'ip' in the events (which doesn't exist), causing the lookup to fail; additionally, `where isnotnull(threat)` would never be true because the threat field was never output.

Full explanation →

161

MCQeasy

A user wants to create a chart showing the count of errors per hour for the last 24 hours, with time bucketed hourly. Which search is correct?

A.index=main error | timechart count span=1h

B.index=main error | bucket _time span=1h | stats count by _time

C.index=main error | chart count by _time span=1h

D.index=main error | timechart count by _time span=1h

AnswerA

Correctly uses timechart with span.

Why this answer

Option A is correct because the `timechart` command automatically creates a time-based chart with a default count aggregation. The `span=1h` argument explicitly sets the bucket size to one hour, which groups events into hourly intervals over the last 24 hours. This produces the exact output the user needs: a count of errors per hour.

Exam trap

Splunk often tests the distinction between `timechart` and `chart` with `_time`, where candidates mistakenly think `chart count by _time span=1h` works like `timechart`, but `chart` does not support the `span` argument and treats `_time` as a categorical field.

How to eliminate wrong answers

Option B is wrong because `bucket _time span=1h` creates a new field `_time` with rounded timestamps, but the subsequent `stats count by _time` produces a table, not a chart, and does not automatically fill in empty time buckets. Option C is wrong because `chart` does not inherently treat `_time` as a time-based axis; it would treat `_time` as a categorical field, potentially creating a column for each unique timestamp rather than hourly buckets. Option D is wrong because `timechart count by _time` is redundant — `timechart` already uses `_time` as its implicit x-axis, and specifying `by _time` can cause unexpected behavior or errors, as `timechart` expects a field to split by, not the time field itself.

Full explanation →

162

MCQhard

A Splunk administrator uses a macro to normalize firewall logs into the CIM Network Traffic data model. The macro includes a field alias that maps `bytes_sent` to `bytes_out`. The mapping works in ad-hoc searches, but when the macro is used in a summary index search, the field is not populated. What is the most likely reason?

A.The alias creates a new field that is not included in the summary index output.

B.The summary index is accelerated and overrides the alias.

C.Field aliases are not supported in macros.

D.The macro is not shared to the global context, so it fails in summary indexing.

AnswerA

Search-time aliases create new fields; if the summary index only stores original fields, the aliased field may not be stored unless explicitly kept.

Why this answer

When populating a summary index, the search runs and then the summary indexer stores the results. If the alias is applied at search time, it may not persist in the summary index unless the alias is also applied at index time or the field is explicitly targeted. The macro applies aliases at search time, but summary indexes store raw events or fields based on the search output; if the alias field is not in the output, it won't be stored.

Option D is correct. Option A (macro not global) would affect ad-hoc too. Option B (alias not allowed) is false.

Option C (summary index acceleration) is unrelated.

Full explanation →

163

Multi-Selectmedium

Which TWO of the following are valid ways to create a macro in Splunk? (choose two)

Select 2 answers

A.Add a macro definition to props.conf under a [source] stanza.

B.Use the CLI command `splunk add macro` with the macro definition.

C.Navigate to Settings > Advanced search > Search macros and click 'New'.

D.Create a macros.conf file in $SPLUNK_HOME/etc/system/local/ and add the macro definition.

E.Edit the macros.conf file in the app's default directory.

AnswersC, D

This is the UI method.

Why this answer

Option C is correct because Splunk provides a GUI-based method to create macros via Settings > Advanced search > Search macros, which is a standard and supported approach. Option D is correct because manually creating a macros.conf file in $SPLUNK_HOME/etc/system/local/ is a valid configuration method that Splunk reads at startup to define macros.

Exam trap

The trap here is that candidates may confuse the valid configuration file location (local directory) with the default directory, or mistakenly think a CLI command exists for macro creation, when Splunk only supports GUI or manual file-based methods.

Full explanation →

164

MCQhard

A team uses a large index with many sourcetypes. They want to find events where the field "status" contains either "error" or "failure" (case-insensitive), and also ensure that "response_time" > 1000. Which search best optimizes performance?

A.index=main | eventstats avg(response_time) as avg by category | stats count as cnt by category | where cnt>=100 | sort -avg | head 5

B.index=main | top category | eval avg=avg(response_time) | where count>=100

C.index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

D.index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5

AnswerD

Correctly computes both statistics and filters.

Why this answer

Option D is correct because it efficiently computes both the average response_time and the count of events per category in a single stats command, then filters by count >=100, sorts by average descending, and returns the top 5 categories. This minimizes data movement and processing by performing all aggregations in one pass, which is optimal for large indexes with many sourcetypes.

Exam trap

Splunk often tests the misconception that you need separate commands for each aggregation (like eventstats then stats) or that you can reference a field in a where clause before it is defined, leading candidates to choose options that either fail syntactically or perform unnecessary intermediate operations.

How to eliminate wrong answers

Option A is wrong because it uses eventstats to compute an average per category but then does not filter on status or response_time, and the where clause references cnt>=100 without defining cnt in the pipeline, leading to incorrect results and unnecessary computation. Option B is wrong because top category returns the most common categories without any filtering on status or response_time, and eval avg=avg(response_time) is invalid in a non-aggregating context, causing a syntax error. Option C is wrong because it computes avg(response_time) but omits the count field, so the where cnt>=100 clause fails due to cnt not being defined, and it does not filter on status or response_time.

Full explanation →

165

MCQhard

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

A.Use the sort command

B.Use a subsearch with the IN operator instead

C.Use the transaction command

D.Use the foreach command to loop over fields

AnswerB

Subsearch performs a single lookup instead of per-event search

Why this answer

Option B is correct because replacing a `map` command with a subsearch using the `IN` operator allows Splunk to retrieve all matching field values in a single search pass, rather than executing a separate search for each value. The `map` command runs one search per input row, which can cause significant overhead and slow performance, especially with large result sets. Using `IN` in a subsearch collects the values first and then applies them as a filter in the outer search, reducing the number of search operations to one.

Exam trap

Splunk often tests the misconception that `map` is the only way to run a search for each value of a field, when in fact a subsearch with `IN` achieves the same result more efficiently by avoiding iterative search execution.

How to eliminate wrong answers

Option A is wrong because the `sort` command only reorders results and does not reduce the number of searches or improve the performance of a `map`-based workflow. Option C is wrong because the `transaction` command groups events into transactions based on fields or time, but it does not replace the iterative search behavior of `map` and can itself be resource-intensive. Option D is wrong because the `foreach` command iterates over fields within a single result row, not over multiple search executions, so it cannot replace the per-value search logic of `map`.

Full explanation →

166

MCQmedium

Refer to the exhibit. What happens when a user clicks on a status value in the table?

A.Nothing happens; the token is not used

B.Both the table and chart update

C.The table filters to show only events with that status

D.The chart updates to show methods for that status

AnswerD

The chart search uses $selected_status$ and refreshes when the token changes.

Why this answer

Option C is correct because the token is set and the chart panel relies on it (depends="$selected_status$"), so the chart updates to show methods for that status. The table does not change because it has no dependency on the token. Option A is incorrect because the table remains unchanged.

Option B is incorrect because only the chart updates. Option D is incorrect because the token update triggers a search refresh.

Full explanation →

167

MCQmedium

A company uses a large Splunk environment with many users creating dashboards. They notice that some searches are slow and consume excessive resources. What is the best practice to optimize search performance?

A.Use the tstats command with summariesonly=t

B.Use the search command with a large time range

C.Use the eval command to create new fields

D.Use the stats command with by clause on high cardinality fields

AnswerA

Uses pre-summarized accelerated data, significantly faster.

Why this answer

The `tstats` command with `summariesonly=t` is the best practice because it queries accelerated data models or summary indices rather than raw event data, drastically reducing the amount of data scanned. This command leverages pre-computed statistics, which is the most efficient way to perform searches over large datasets, especially when users are building dashboards that run repeatedly.

Exam trap

Splunk often tests the misconception that `tstats` is only for advanced users or that it requires a data model, but the trap here is that candidates confuse `tstats` with `stats` and think any aggregation command is equally efficient, ignoring the critical role of summary acceleration.

How to eliminate wrong answers

Option B is wrong because using the `search` command with a large time range forces Splunk to scan all raw events across that entire period, which is resource-intensive and slow, the opposite of optimization. Option C is wrong because the `eval` command creates new fields at search time, adding computational overhead and not reducing the data volume; it does not leverage any pre-computed summaries. Option D is wrong because using the `stats` command with a `by` clause on high cardinality fields (e.g., user IDs or IP addresses) creates many distinct groups, consuming significant memory and CPU, and can even cause search failures due to memory limits.

Full explanation →

168

MCQmedium

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

A.... | eval running_total = running_sum(sales)

B.... | sort date | streamstats sum(sales) as running_total

C.... | eventstats sum(sales) as running_total

D.... | stats sum(sales) by date

AnswerB

streamstats with sum calculates cumulative sum over sorted events.

Why this answer

Option B is correct because it first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Exam trap

Splunk often tests the distinction between `streamstats` (sequential, cumulative) and `eventstats` (non-sequential, global aggregate), and candidates mistakenly choose `eventstats` thinking it computes a running total because it adds a field to each event.

How to eliminate wrong answers

Option A is wrong because `running_sum()` is not a valid Splunk function; the correct function for cumulative sums is `streamstats sum()`. Option C is wrong because `eventstats` computes an aggregate statistic (e.g., total sum) over the entire result set and adds it to each event, not a running total per day. Option D is wrong because `stats sum(sales) by date` returns a single total per day, not a cumulative sum that grows across days.

Full explanation →

169

MCQhard

A large organization uses Splunk to monitor its network infrastructure. They have a single saved search that runs every hour to create a summary index for each of the 50 network device sourcetypes. The saved search uses a macro named `build_network_summary` that accepts two arguments: `sourcetype` and `time_range`. The macro definition is: ``` [build_network_summary] definition = index=network sourcetype=$sourcetype$ earliest=$time_range$ latest=now | stats count by src_ip, dest_ip, protocol | collect index=network_summary args = sourcetype, time_range iseval = 0 ``` The saved search iterates over the 50 sourcetypes using a separate lookup or list. Recently, the security team noticed that the network_summary index is missing data for certain sourcetypes, specifically those with hyphens in their names (e.g., `cisco-asa`, `juniper-srx`). For other sourcetypes, the summary is complete. The saved search runs without errors in Splunk's job inspector. Which course of action should the administrator take to resolve the issue?

A.Increase the summary index range to cover all sourcetypes in one pass rather than iterating.

B.Modify the macro definition to enclose the `$sourcetype$` argument in quotation marks: `sourcetype="$sourcetype$"`

C.Change the macro's time_range argument to use a static time range to avoid relative time issues.

D.Enable acceleration on the network_summary index to improve data completeness.

AnswerB

Quoting prevents hyphens from being interpreted as search operators.

Why this answer

Option A is correct: the hyphens in sourcetype names are being interpreted as subtraction operators or search syntax modifiers because the macro argument is not quoted. Option B would increase load but not fix the parsing. Option C addresses time range, not sourcetype.

Option D is unrelated.

Full explanation →

170

Multi-Selecteasy

Which THREE steps are necessary to create a file-based lookup?

Select 3 answers

A.Upload the lookup file to the correct directory.

B.Define a lookup definition in transforms.conf.

C.Create a lookup definition in props.conf.

D.Define an automatic lookup in props.conf.

E.Restart Splunk.

AnswersA, B, E

The file must be placed in the app's lookups directory (e.g., $SPLUNK_HOME/etc/apps/search/lookups).

Why this answer

A, B, and D are necessary. Upload the file to the correct lookups directory (A), define a lookup definition in transforms.conf (B), and restart Splunk to apply changes (D). C is not required; props.conf is for field extractions, not lookup definitions.

E is optional only if you want automatic lookup.

Full explanation →

171

MCQeasy

A Splunk admin wants to create a macro named `filter_by_app` that accepts an application name as an argument and returns a search string filtering by that application. The application name may contain spaces. Which of the following correctly defines the macro's arguments and usage?

A.Definition: `filter_by_app(1)` and usage: `index=main app=$1$`

B.Definition: `filter_by_app($app$)` and usage: `index=main app=$app$`

C.Definition: `filter_by_app($app$)` and usage: `index=main app="$app$"`

D.Definition: `filter_by_app(app)` and usage: `index=main app=app`

E.Definition: `filter_by_app($1)` and usage: `index=main app=$1`

AnswerC

Correctly uses `$app$` in both definition and usage with quotes for spaces.

Why this answer

Option C is correct because macro arguments must be referenced with `$arg$` syntax and when the value contains spaces, it must be quoted. Option A uses `$app$` without quotes in usage, which fails for spaces. Option B uses `$1$` which is numeric syntax but missing trailing dollar? Actually B has `$1$` correct, but usage also uses `$1$` and no quotes, so fails.

Option D uses `app` without dollar signs, not valid. Option E uses `$1` missing trailing dollar.

Full explanation →

172

MCQeasy

Which of the following is true about the sort command?

A.All of the above

B.It only sorts in ascending order by default

C.It can sort by multiple fields

D.It can use the limit parameter to limit results

AnswerA

All statements are correct.

Why this answer

Option A is correct because the sort command in Splunk can sort in ascending order by default, can sort by multiple fields, and can use the limit parameter to restrict the number of results. All three statements (B, C, and D) are true, making 'All of the above' the correct choice.

Exam trap

The trap here is that candidates may assume only one of B, C, or D is true, but the question is designed to test whether you recognize that all three statements are accurate, leading to 'All of the above' as the correct answer.

How to eliminate wrong answers

Option B is not wrong because it is true: the sort command sorts in ascending order by default unless the '-' prefix is used to specify descending order. Option C is not wrong because it is true: you can sort by multiple fields by listing them separated by commas, e.g., `sort field1, field2`. Option D is not wrong because it is true: the limit parameter (e.g., `sort limit=10 field`) restricts the output to the top N results based on the sort order.

Full explanation →

173

MCQeasy

A Splunk admin is tasked with creating a set of macros that will be used by multiple app developers to standardize searches across the organization. The macros need to accept parameters such as index, sourcetype, and time range. Some macros will be complex and include subsearches. Which approach should the admin take to ensure maximum reusability and maintainability?

A.Create separate macros for each combination of parameters.

B.Embed all logic into a single macro and use conditional statements.

C.Use macro arguments with default values and include comments in the definition.

D.Define macros with no arguments and rely on the developers to modify the macro code.

AnswerC

Correct: Arguments with defaults allow flexible use, and comments improve maintainability.

Why this answer

Option C is correct: Using macro arguments with default values and comments provides flexibility and clarity. Defining macros without arguments forces users to edit for each use. Separate macros for each parameter combination create unnecessary duplication.

A single macro with conditionals becomes complex and hard to maintain.

Full explanation →

174

MCQhard

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

A.The lookup file is not distributed to all indexers.

B.The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.

C.The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

D.The max_matches should be set to 0.

E.The lookup definition is missing the default_match setting, which should be set to 'no_match'.

AnswerB

Splunk field names are case-sensitive; the mismatch causes no match, returning the default 'UNKNOWN'.

Why this answer

Option B is correct because Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Exam trap

The trap here is that candidates often assume Splunk field matching is case-insensitive, but Splunk treats field names in lookups as case-sensitive, leading to silent failures when the CSV header case does not match the event field case.

How to eliminate wrong answers

Option A is wrong because the lookup file is used in a search that runs on the search head; it does not need to be distributed to indexers unless it is used in an index-time lookup or a distributed lookup scenario, which is not indicated. Option C is wrong because the default match_type is EXACT, but the issue is a field name mismatch (case sensitivity of the field name itself), not case variations in the data values. Option D is wrong because max_matches controls how many matching rows to return per event; setting it to 0 would return no matches, but the core problem is that no match is found due to field name mismatch, not the number of matches.

Option E is wrong because the default_match setting controls what value to output when no match is found; while it could be set to 'no_match', the root cause is the field name mismatch, not the absence of this setting.

Full explanation →

175

MCQeasy

A Splunk admin wants to create a macro that extracts the username from a log line that always starts with 'User: <username>'. The macro should be reusable across searches. Which definition is correct?

A.`rex field=_raw "User: (?<username>\S+)"`

B.`eval username=extract("User: (?<username>\S+)")`

C.`rex field=_raw "User: (?<username>\S+)" | eval username=$result$`

D.`username = rex field=_raw "User: (?<username>\S+)"`

AnswerA

This is a valid macro definition for extraction.

Why this answer

Option A is correct because the `rex` command with `field=_raw` and a named capturing group `(?<username>\S+)` extracts the username into a field called `username`. This is the standard Splunk way to perform regex extraction in a search, and wrapping it in a macro makes it reusable across searches without additional syntax.

Exam trap

Splunk often tests the distinction between `rex` (a transforming command) and `eval` (a non-transforming command), and candidates mistakenly try to use `eval` with regex functions that do not exist in Splunk.

How to eliminate wrong answers

Option B is wrong because `extract()` is not a valid Splunk eval function; regex extraction must use `rex` or `replace` with `rex` mode, not `eval`. Option C is wrong because `$result$` is not a valid token in this context; `rex` directly populates the named field, and piping to `eval` with `$result$` is unnecessary and incorrect. Option D is wrong because `username = rex ...` is not valid SPL syntax; `rex` is a standalone command, not an assignment within an eval expression.

Full explanation →

176

Multi-Selecthard

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Select 3 answers

A.Lookups can be used to add fields from an external source

B.Lookups can only be used with exact match

C.Lookups require the data to be indexed in Splunk

D.A lookup can be configured as automatic in props.conf

E.Lookups can be based on CSV files or KV store

AnswersA, D, E

That is the primary purpose of lookups: enrichment.

Why this answer

Lookups can be automatic via props.conf, can be based on CSV or KV Store, and are used to add fields from an external source. They are not limited to exact match (range lookups exist) and do not require data to be indexed in Splunk.

Full explanation →

177

Multi-Selectmedium

Which TWO settings are required in a transforms.conf stanza for a file-based lookup to work? (Select two.)

Select 2 answers

A.max_matches

B.match_type

C.case_sensitive_match

D.filename

E.default_match

AnswersB, D

Required to define the matching algorithm (e.g., exact, CIDR).

Why this answer

Options A and C are correct because filename specifies the lookup file, and match_type specifies how to compare the source field (e.g., exact, CIDR). Options B, D, and E are optional: max_matches limits matches, default_match provides a default value, case_sensitive_match is an advanced option.

Full explanation →

178

Multi-Selectmedium

A Splunk search uses 'transaction' to correlate events. The transaction times out before all expected events are added. Which TWO options can be adjusted to allow more time for transaction completion? (Choose two.)

Select 2 answers

A.Increase 'maxopentxn'.

B.Set 'connected=false'.

C.Increase 'maxevents'.

D.Decrease 'maxspan'.

E.Increase 'maxtime' in the transaction command.

AnswersC, E

Correct: Allows more events per transaction.

Why this answer

Options A and C are correct. 'maxtime' controls the time limit for transaction processing, and 'maxevents' controls the maximum number of events per transaction; increasing these can help prevent timeout. Option B reduces time, D disables connected events, E affects open transactions.

Full explanation →

179

Multi-Selecteasy

Which TWO of the following are valid uses of the Common Information Model (CIM) in Splunk?

Select 2 answers

A.Defining user roles and permissions for data access.

B.Managing license usage across indexers.

C.Creating new indexes for faster search performance.

D.Defining tags and event types to categorize data.

E.Normalizing data from different sources to a common field naming convention.

AnswersD, E

CIM uses tags and event types to map data to models.

Why this answer

Option D is correct because the CIM provides a standardized set of tags and event types that allow you to categorize and classify data from diverse sources, enabling consistent searching and correlation across your Splunk environment. Option E is correct because the CIM defines common field names (e.g., src_ip, dest_ip, user) to normalize data from different technologies, ensuring that searches and dashboards work uniformly regardless of the original data source.

Exam trap

The trap here is that candidates often confuse the CIM with operational or administrative features (like roles, licensing, or index management) because they are all part of Splunk's ecosystem, but the CIM is strictly a semantic layer for data normalization and categorization.

Full explanation →

180

MCQmedium

A search returns events with a field 'response_time' in milliseconds. The analyst wants to categorize response times into three buckets: 'fast' (< 100), 'medium' (100-500), 'slow' (> 500). Which search correctly creates this categorization?

A.| eval bucket=case(response_time<100,"fast", response_time>=100 AND response_time<=500,"medium", response_time>500,"slow")

B.| eval bucket=if(response_time<100,"fast",response_time<500,"medium","slow")

C.| eval bucket=if(response_time<100,"fast",if(response_time<=500,"medium","slow"))

D.| where response_time<100 | eval bucket="fast" | append [search where response_time>=100 AND response_time<=500 | eval bucket="medium"]

AnswerA

case evaluates conditions in order and returns the first true match.

Why this answer

Option A is correct because it uses the `case` function to evaluate multiple conditions in order, assigning 'fast' for response_time < 100, 'medium' for values between 100 and 500 inclusive, and 'slow' for values > 500. The `case` function returns the result of the first true condition, making it ideal for mutually exclusive buckets without overlapping logic.

Exam trap

Splunk often tests the difference between `if` and `case` functions, where candidates mistakenly think nested `if` is the only way to handle multiple conditions, overlooking that `case` is the idiomatic Splunk command for multi-bucket categorization and that `if` with a single condition cannot handle more than two outcomes without nesting.

How to eliminate wrong answers

Option B is wrong because the `if` function only supports a single condition; the second argument (response_time<500) is treated as the 'true' value for the first condition, and 'slow' is the 'false' value, so response times between 100 and 500 are incorrectly labeled 'slow' (since they are not <100, the else branch runs, but the else branch is a single value, not a nested condition). Option C is wrong because it uses nested `if` functions, which is syntactically valid but less efficient and error-prone; however, the logic is actually correct for this specific case, but the question asks for the 'correct' search, and Option A is the standard Splunk approach using `case` for clarity and maintainability. Option D is wrong because it uses `where` and `append` to create separate result sets, which is overly complex, inefficient, and does not produce a single bucket field for all events in one pass; it also fails to handle events that don't match any condition (e.g., response_time exactly 100 or 500 are not covered by the first `where`).

Full explanation →

181

MCQeasy

Which command creates a new field that contains the string 'high' if a numeric field exceeds 100, otherwise 'low'?

A.eval status=if(value>100,"high","low")

B.eval status=case(value>100,"high",true(),"low")

C.eval status=if(value>100,high,low)

D.None of the above

AnswerA

Correct syntax with quoted strings.

Why this answer

Option A is correct because the `eval` command with the `if` function correctly checks if the numeric field `value` exceeds 100 and returns the string 'high' or 'low'. In Splunk's `eval`, the `if` function requires the true and false results to be quoted strings when they are literal text, as shown in option A.

Exam trap

Splunk often tests the requirement to quote string literals in `eval` expressions, and the trap here is that candidates may forget to quote the string values 'high' and 'low', treating them as field names instead of literal strings.

How to eliminate wrong answers

Option B is wrong because the `case` function syntax is incorrect: the condition `value>100` is followed by `"high"`, but the default case uses `true()` without a corresponding result string; the correct syntax would be `case(value>100,"high",1=1,"low")` or similar. Option C is wrong because the `if` function's true and false results are unquoted (`high` and `low`), which Splunk interprets as field names or variable references, not literal strings, leading to errors or unexpected behavior. Option D is wrong because option A is correct.

Full explanation →

182

MCQeasy

An analyst runs this search and gets no results. The lookup file server_list.csv exists and contains data. What is the most likely issue?

A.The lookup file is not in the correct lookup directory.

B.The field names in the CSV do not match the search fields.

C.The search should include an index specification.

D.The search should use 'lookup' instead of 'inputlookup'.

AnswerB

If the CSV has different field names, the search conditions won't match, resulting in zero results.

Why this answer

Option C is correct because the field names in the CSV must match the search fields (status, hostname, ip_address). If the CSV uses different field names, no results will be returned. Options A, B, and D are less likely or incorrect.

Full explanation →

183

Multi-Selecteasy

Which TWO of the following are valid ways to define arguments in a Splunk macro?

Select 2 answers

A.In the macro definition, use $arg1$, $arg2$ as placeholders for the arguments.

B.Arguments are defined by listing them in the 'args' attribute in macros.conf.

C.In the macro definition, use $1$, $2$ as positional placeholders.

D.Arguments are automatically inferred from the search string in the macro definition.

E.In the macro definition, use named placeholders like $error_code$.

AnswersA, B

Correct. $arg1$, $arg2$ are the standard positional placeholders.

Why this answer

Option A is correct because Splunk macros use named placeholders like $arg1$, $arg2$ in the macro definition to represent arguments. When the macro is invoked, these placeholders are replaced with the actual values passed by the user, allowing flexible and reusable search snippets.

Exam trap

Splunk often tests the distinction between named placeholders ($arg1$) and positional placeholders ($1$), leading candidates to mistakenly think positional placeholders are valid in Splunk macros when they are not.

Full explanation →

184

MCQhard

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

A.The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.

B.The limit parameter is misused; it should be 'limit=0' to show all hosts.

C.The timechart command automatically uses 'other' for the remaining hosts.

D.The limit parameter applies to the entire search, not per bucket.

E.The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

AnswerA

Adding useother=t groups remaining hosts into 'Other' to account for total count.

Why this answer

Option E is correct because without useother=t, the timechart drops all hosts beyond the top 5. Option A is misleading because the total count is not shown. Options B, C, and D are incorrect descriptions of the command behavior.

Full explanation →

185

MCQhard

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

A.index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

B.index=web | stats avg(response_time) by user | where response_time < 10000

C.index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

D.index=web | where response_time < 10000 | stats avg(response_time) by user

AnswerD

Filters outliers first, then computes average per user.

Why this answer

Option B is correct because it filters out outliers before computing the average per user. Option A filters after stats, so the average still includes outliers. Option C filters after stats as well, but tries to nullify the average, which is incorrect.

Option D uses eventstats to compute overall average, then filters, then computes per-user average; this still includes outliers in the per-user average because the filter does not retroactively change the eventstats calculation.

Full explanation →

186

Multi-Selectmedium

An administrator is designing a dashboard with multiple panels that share a common time picker. Which THREE dashboard features can be used to synchronize time across panels?

Select 3 answers

A.Use the 'link time' option in dashboard editor

B.Use the $time_token$ variable in panel searches

C.Use a single time input with a token

D.Set each panel's time range independently

E.Use the 'earliest' and 'latest' fields with a shared token

AnswersB, C, E

Referencing the token ensures panels share the same time.

Why this answer

Using a single time input with a token, referencing the token in panel searches, and using earliest/latest fields with the token are standard methods. Setting each panel independently does not synchronize, and 'link time' is not a standard feature.

Full explanation →

187

Multi-Selectmedium

A Splunk user wants to create a stacked bar chart showing the count of events by status (success, failure) over time. Which TWO configuration steps are necessary?

Select 2 answers

A.Use the timechart command with a split-by field

B.Use the eval command to create a new field

C.Use the chart command with a split-by field

D.Select the 'line' chart type

E.Set the stack mode to 'stacked' in visualization options

AnswersA, E

timechart count by status produces time-series data with separate series.

Why this answer

To create a stacked bar chart over time, you need to use timechart with a split-by field to get time series and then set the stack mode to stacked in visualization options. Chart command does not inherently produce time series, and eval is not needed. Line chart is not stacked bar.

Full explanation →

188

MCQhard

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

A.`index=main | stats perc95(response_time) by service`

B.`index=main | timechart perc95(response_time) by service`

C.`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

D.`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

AnswerC

Correctly calculates the 95th percentile per service using eventstats and then collapses to one value per service.

Why this answer

Option C is correct because `eventstats` computes the 95th percentile per service across all events in the result set, adding the value as a new field to each event, and then `stats values(p95) by service` collapses the identical values into a single row per service. This avoids the overhead of time-based bucketing and ensures the percentile is calculated over the entire hour's data in one pass, making it both accurate and efficient.

Exam trap

Splunk often tests the distinction between `eventstats` (global aggregation appended to events) and `streamstats` (running aggregation per event), and candidates mistakenly choose `streamstats` thinking it computes a final percentile, when it actually produces a cumulative value that changes with each event.

How to eliminate wrong answers

Option A is wrong because `stats perc95(response_time) by service` is not valid syntax; the correct function is `perc95(response_time)` or `exactperc95(response_time)`, and `perc95` is not a recognized stats function in Splunk. Option B is wrong because `timechart` automatically splits the data into time buckets (e.g., 1-minute spans), which would calculate the 95th percentile per time slice rather than over the entire past hour, producing incorrect results for the requirement. Option D is wrong because `streamstats` computes a running (cumulative) percentile as each event is processed, not the overall percentile for the entire hour, and `latest(p95)` would only capture the final running value, which is not the same as the global 95th percentile.

Full explanation →

189

MCQeasy

Which of the following is required to create a dynamic lookup that automatically updates from a CSV file?

A.Define the lookup in transforms.conf and props.conf

B.Use the lookup command in searches

C.Upload the CSV to the lookups folder only

D.Only define in transforms.conf

AnswerA

Both files are needed: transforms.conf defines the lookup, props.conf associates it with a source type for automatic application.

Why this answer

For an automatic lookup that updates when the file changes, you must define the lookup in both transforms.conf and props.conf. Simply defining in transforms.conf or uploading the file is insufficient without props.conf to enable the automatic lookup.

Full explanation →

190

MCQmedium

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

A.Add `| head 1000` before the `transaction` command

B.Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`

C.Set `maxspan=1h` and `maxpause=1m`

D.Add `| eval session_id=random()` before transaction

AnswerB

`stats` is more efficient and can approximate sessions.

Why this answer

Option B is correct because replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Exam trap

Splunk often tests the misconception that `transaction` is the only way to group events into sessions, when in fact `stats` with `bin` or `eventstats` can achieve similar results with far better performance.

How to eliminate wrong answers

Option A is wrong because adding `| head 1000` before `transaction` would discard most events, producing incomplete and misleading session data, and does not address the root cause of slow performance. Option C is wrong because tightening `maxspan` and `maxpause` may reduce the number of events grouped per session but does not eliminate the fundamental overhead of the `transaction` command's stateful processing. Option D is wrong because `| eval session_id=random()` before `transaction` adds a random field that has no correlation with actual sessions, and `transaction` would still need to process all events with the same overhead.

Full explanation →

191

Multi-Selecteasy

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Select 2 answers

A.Use wildcard characters at the beginning of search terms.

B.Use the transaction command to group events.

C.Reduce the time range of the search.

D.Use the dedup command as early as possible.

E.Use indexed fields instead of search-time extracted fields.

AnswersC, E

Limits data volume scanned

Why this answer

Reducing the time range limits the volume of data scanned by the search head, directly reducing I/O and processing overhead. This is one of the most effective ways to improve search performance because Splunk must read and filter every event in the specified time window from the index.

Exam trap

Splunk often tests the misconception that using the transaction or dedup command early in a search improves performance, when in fact these commands are memory-intensive and should be deferred until after data volume is reduced.

Full explanation →

192

MCQeasy

A team wants to visualize sales data on a map. They have a lookup table containing city names and their latitude/longitude coordinates. Which visualization type should they use in Splunk to plot the sales amounts on a map?

A.Single value

B.Gauge

C.Choropleth map

D.Scatter plot

AnswerC

Choropleth maps color regions based on values.

Why this answer

C is correct because a choropleth map uses geographic boundaries (e.g., countries, states, or cities) and shades or colors them based on a numeric value, such as sales amounts. With a lookup table providing latitude/longitude coordinates, Splunk can geocode the city names and overlay the sales data on a map using the `geostats` command, which is designed for choropleth visualizations.

Exam trap

The trap here is that candidates often confuse a scatter plot (which can plot lat/lon as x/y coordinates) with a choropleth map, but Splunk's scatter plot does not support geographic boundary shading or the `geostats` command required for map-based aggregation.

How to eliminate wrong answers

Option A is wrong because a single value visualization displays one metric (e.g., total sales) as a large number or gauge, not a geographic map. Option B is wrong because a gauge shows a single numeric value within a range (e.g., a speedometer-style dial) and cannot plot multiple data points across locations. Option D is wrong because a scatter plot plots individual points on an x-y axis based on two numeric fields, not geographic coordinates; while it could theoretically use lat/lon as axes, it lacks the boundary-based shading and geographic context of a choropleth map.

Full explanation →

193

MCQhard

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

A.Use | where status=401 | dedup src_ip | timechart count by region

B.Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart

C.Use | where status=401 | mvexpand region | timechart count by region

D.Use | where status=401 | top limit=100 region

AnswerB

Filters early and ensures one region per event.

Why this answer

Option B is correct because modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Exam trap

The trap here is that candidates may think `mvexpand` or `dedup` can fix the multivalue region issue, but they fail to realize that these commands either inflate counts or discard valid data, whereas adjusting the lookup configuration is the proper solution.

How to eliminate wrong answers

Option A is wrong because `dedup src_ip` removes duplicate source IPs but does not resolve the multiple region values per event; it may also incorrectly discard legitimate events from the same IP with different timestamps or regions. Option C is wrong because `mvexpand region` creates multiple events from a single event (one per region), which inflates the count of failed logins and produces inaccurate results. Option D is wrong because `top limit=100 region` only shows the top 100 regions by count, not a time-based visualization, and does not filter to a single region per event.

Full explanation →

194

MCQmedium

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

A.The regex pattern is incorrect.

B.The field 'ip' is not extracted properly.

C.The `search` command should be `where` to use wildcard on extracted fields.

D.The index should be specified at the beginning of the search.

AnswerC

For extracted (non-indexed) fields, `search` may not support wildcards efficiently; `where` with `like` is appropriate.

Why this answer

The search uses `search ip=10.0*` which attempts to apply a wildcard pattern to an extracted field. However, the `search` command does not support wildcards for field-value comparisons; it treats `10.0*` as a literal string. To use wildcards on extracted fields, the `where` command with a `like` operator (e.g., `where ip like "10.0%"`) or a regex match is required.

This is why option C is correct.

Exam trap

Splunk often tests the misconception that the `search` command supports wildcards for extracted fields, leading candidates to overlook the need for `where` or `regex` commands for pattern matching on field values.

How to eliminate wrong answers

Option A is wrong because the regex pattern is not the issue; the search does not use a regex command at all, and the problem lies in the `search` command's inability to interpret wildcards on field values. Option B is wrong because the field 'ip' is likely extracted properly (otherwise the search would not run without errors), but the wildcard matching fails due to command semantics. Option D is wrong because specifying the index at the beginning is a best practice for performance but is not required for the search to return results; the absence of an index does not cause zero results when the data is already in the default index.

Full explanation →

195

MCQhard

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

A.Change maxpause to 30s.

B.Remove the eval command.

C.Replace transaction with stats and use values() for fields.

D.Add a time range to the main search.

AnswerD

Limiting the time range reduces the amount of data processed, improving performance.

Why this answer

The exhibit shows a transaction command that groups events by a session field, but without a time range, the search must scan all indexed data, which is extremely slow. Adding a time range (e.g., earliest=-1h) limits the data scanned, drastically improving performance while still allowing the transaction to complete within the default maxpause of 5s.

Exam trap

The trap here is that candidates focus on tuning the transaction parameters (maxpause) or replacing the command, rather than recognizing that the fundamental performance bottleneck is the absence of a time range filter in the base search.

How to eliminate wrong answers

Option A is wrong because increasing maxpause to 30s would make the transaction wait longer for late events, potentially increasing search time and resource usage, not improving performance. Option B is wrong because removing the eval command (which likely creates the session field used by transaction) would break the grouping logic, making the search return incorrect or no results. Option C is wrong because replacing transaction with stats and values() might reduce memory overhead but would not address the root cause of scanning all time; without a time range, stats would still scan the entire index, and the search would remain slow.

Full explanation →

196

Multi-Selecteasy

Which of the following are valid ways to define a macro in Splunk? (Choose two.)

Select 2 answers

A.Using the `macro` command in a saved search

B.Using the `| macro` command in a search

C.Using named arguments like $field$ in the definition, with the argument names defined in the macro properties

D.Using the `define` command in the search bar

E.Using positional arguments like $1$ in the definition

AnswersC, E

Correct: Named arguments require definition in properties.

Why this answer

Options A and B are correct: Macros can use positional arguments ($1$) or named arguments (with user-defined names) that are defined in the macro properties. Option C is invalid; there is no `define` command. Option D is invalid; macros are defined in the Macros section of Knowledge Objects, not via a command.

Option E is invalid; there is no `| macro` command.

Full explanation →

197

MCQmedium

Which command is best for calculating a running total of sales per customer across events without creating a multivalued field?

A.streamstats

B.stats

C.transaction

D.eventstats

AnswerA

streamstats computes windowed functions like running total per group.

Why this answer

Option C is correct because streamstats can compute a running total per customer. Option A (eventstats) adds an aggregate but not per-row progression. Option B (stats) is for aggregation, not running.

Option D (transaction) groups events but does not compute running totals.

Full explanation →

198

MCQhard

A Splunk admin creates a macro named `lookup_user` that is defined as `| lookup user_lookup user AS $1$ OUTPUT full_name as user_name`. The macro is used in a search like `index=main | `lookup_user(user_id)`. However, the results show no matches even though valid user_id values exist. What is the most likely cause?

A.The macro is missing a closing parenthesis

B.The lookup file does not have a field named `user`

C.The lookup command should be `inputlookup` instead of `lookup`

D.The macro definition incorrectly includes a leading pipe

AnswerD

Correct: Double pipe causes the lookup to fail.

Why this answer

Option D is correct: Because the macro is invoked with a pipe (`| `lookup_user...), the definition should not include a leading pipe. If it does, the expanded search becomes `| | lookup...`, which causes a syntax error or unexpected behavior. Option A could be possible but less likely; if the lookup file lacks the field `user`, the lookup would fail silently.

Option B not likely. Option C inputlookup is for static lookups.

Full explanation →

199

MCQhard

A search returns 50,000 events. The analyst wants to sample 1% evenly across time. Which sampling command should be used?

A.sample 0.01

B.sample method=random ratio=0.01

C.sample method=block ratio=0.01

D.sample ratio=0.01

AnswerB

This performs random sampling with a 1% ratio, distributing events evenly across time.

Why this answer

Option B is correct because the `sample` command with `method=random` and `ratio=0.01` performs a random sampling of exactly 1% of events, and when used without a `by` clause, it distributes the sampling evenly across time by default. This ensures a statistically representative subset of the 50,000 events, preserving temporal distribution.

Exam trap

The trap here is that candidates often assume `sample` defaults to random sampling, but it actually defaults to `method=block`, so omitting the `method=random` parameter (as in option D) would not achieve the required even distribution across time.

How to eliminate wrong answers

Option A is wrong because `sample 0.01` is invalid syntax; the `sample` command requires the `ratio` argument to be explicitly named (e.g., `ratio=0.01`) and does not accept a bare number. Option C is wrong because `method=block` samples contiguous blocks of events, which would not distribute evenly across time and could cluster events from a specific time period, violating the requirement for even temporal distribution. Option D is wrong because `sample ratio=0.01` defaults to `method=block`, not `method=random`, so it would produce block sampling rather than the random sampling needed for even distribution across time.

Full explanation →

200

MCQhard

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

A.Reduce the time range to 1 hour.

B.Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

C.Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.

D.Remove the maxspan parameter from the transaction command to allow longer sessions.

AnswerC

Much more efficient because stats uses less memory than transaction.

Why this answer

Option D is correct because using 'stats' with 'range(_time)' by session_id to compute duration is much more efficient than transaction. Option A removes the maxspan, which may cause sessions to be open-ended and consume more memory. Option B reduces the time range but does not address the inefficiency of transaction.

Option C adds an eventstats that does not replace the transaction.

Full explanation →

201

MCQmedium

A company wants to correlate events from multiple sources that share a common transaction ID. The events arrive in real time but with variable delays. Which transaction option ensures that a transaction closes after 2 minutes of inactivity?

A.endswith="end"

B.maxspan=2m

C.maxpause=2m

D.startswith="start"

AnswerC

maxpause closes transaction if no matching event arrives within 2 minutes.

Why this answer

Option B is correct because maxpause closes a transaction after a period of inactivity. Option A (maxspan) would close after total time. Option C (startswith) and Option D (endswith) define boundaries.

Full explanation →

202

MCQhard

A Splunk administrator is troubleshooting a search that uses the transaction command to group login and logout events. The search runs but returns no results even though both types of events exist. The events are separated by at most 5 minutes. The current transaction command is: `index=auth (action=login OR action=logout) | transaction action maxspan=10m maxpause=2s` What is the most likely cause?

A.The maxspan value is too large, causing events to be grouped incorrectly.

B.The transaction command requires the connected=true argument to group events.

C.The transaction command requires keepevents=true to retain all events.

D.The maxpause value is too small; events may be more than 2 seconds apart.

AnswerD

maxpause sets the maximum time between events in a transaction; 2 seconds may be too restrictive.

Why this answer

The maxpause=2s parameter defines the maximum allowed gap between consecutive events in a transaction. If the actual time between a login and its corresponding logout event exceeds 2 seconds, the transaction command will close the transaction prematurely, treating the logout as the start of a new transaction. Since the events are separated by at most 5 minutes but could be more than 2 seconds apart, the maxpause value is too restrictive, causing the transaction to never complete with both events.

Exam trap

Splunk often tests the distinction between maxspan (total transaction duration) and maxpause (gap between events), leading candidates to incorrectly assume that a large maxspan is the problem when the real issue is an overly restrictive maxpause.

How to eliminate wrong answers

Option A is wrong because a maxspan of 10 minutes is appropriate for events separated by at most 5 minutes; a larger maxspan does not cause grouping errors—it simply allows a wider window. Option B is wrong because the connected=true argument is used for subsearches or to enforce field-based connections, not for the basic transaction command which groups by the specified field (action) by default. Option C is wrong because keepevents=true is used to retain all raw events in the transaction output for inspection, but its absence does not prevent the transaction from forming; it only affects whether individual events are preserved in the results.

Full explanation →

203

MCQhard

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

A.Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

B.Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

C.Reduce the search time window to 5 minutes to decrease execution time.

D.Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.

AnswerD

This prevents overlapping runs by skipping if still running.

Why this answer

Option D is correct because the 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Exam trap

The trap here is that candidates often confuse increasing the schedule interval or reducing the time window as a solution, but the correct approach is to use the built-in overlap prevention setting, which directly addresses the problem of overlapping runs without altering the search logic or data coverage.

How to eliminate wrong answers

Option A is wrong because simply increasing the schedule interval to 20 minutes does not guarantee the search will complete within that time; it only reduces the frequency of runs, but the search could still overlap if execution time varies. Option B is wrong because 'Schedule Priority' and 'Schedule Window' control when the search runs relative to other scheduled searches, not whether overlapping runs are prevented; setting 'Schedule Window' to 0 forces immediate execution but does not handle overlap. Option C is wrong because reducing the search time window to 5 minutes may not capture the required data and does not address the root cause of the search taking longer than the interval; it could also lead to incomplete or inaccurate results.

Full explanation →

204

MCQmedium

A Splunk administrator needs to schedule a saved search to run every second Friday at 10:00 AM. Which cron expression should be used?

A.0 10 * * 5

B.0 10 8-14 * 5

C.0 10 */2 * *

D.0 10 * * *

AnswerB

This runs at 10:00 AM on Fridays that fall between the 8th and 14th of the month, which covers the second Friday.

Why this answer

The cron expression for 'every second Friday at 10:00 AM' is '0 10 * * 5' (every Friday at 10:00), but to run only on the second Friday, a combination with day-of-month is needed. The correct approach is to use '0 10 8-14 * 5' to run on Fridays between 8th and 14th (the second Friday typically falls in that range). Option C is correct.

Option A runs daily. Option B runs every Friday. Option D runs every second day.

Full explanation →

205

MCQmedium

The search above is executed but returns unexpected results: the count for 'API' is much lower than expected. What is the most likely cause?

A.The stats command should use 'count by category' but category is not a field until after eval.

B.The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'.

C.The case function has a default condition '1==1' that overrides all other conditions.

Why this answer

The regex uses (?<method>...) but the group names are case-sensitive; 'method' and 'url' are extracted correctly. However, the issue is that the regex expects exactly one space between method and URL, but some HTTP requests may have additional spaces or different formatting. More importantly, the 'category' eval uses match functions; if the URL field is not extracted for some events (e.g., due to regex failure), category becomes null.

But the most likely cause is that the regex does not account for query strings or fragments in the URL, causing the match to fail when URL contains '?' or '#'.

Full explanation →

206

Multi-Selecteasy

Which THREE of the following are valid methods to create a lookup table in Splunk?

Select 3 answers

A.Use the REST API to upload a CSV file.

B.Define a lookup in props.conf with a filename.

C.Upload a CSV file via the Lookups menu in Settings.

D.Use the 'outputlookup' command in a search.

E.Use the 'inputlookup' command to create a new file.

AnswersA, C, D

The REST API allows programmatic upload of lookup files.

Why this answer

Options A, B, and E are correct. You can upload a CSV via the Settings menu, use the outputlookup command to create a lookup from search results, or use the REST API. Options C and D are incorrect because props.conf does not create lookups, and inputlookup reads but does not create.

Full explanation →

207

Multi-Selecthard

A search administrator wants to ensure that a scheduled search runs efficiently and does not impact other users. Which TWO practices should be implemented? (Select two.)

Select 2 answers

A.Set the 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range

B.Use the 'max_time' setting in the search command

C.Use 'collect' to index summary results

D.Enable 'auto_summarize' on the search

E.Use the 'priority' setting in savedsearches.conf

AnswersA, D

Reduces data scanned, making search faster.

Why this answer

Option A is correct because setting 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range limits the data scanned by the scheduled search, reducing resource consumption and preventing it from impacting other users. Option D is correct because enabling 'auto_summarize' on the search creates pre-computed summary tables that allow the scheduled search to run against summarized data rather than raw events, drastically improving efficiency and reducing system load.

Exam trap

The trap here is that candidates often confuse 'max_time' (a command-level timeout) with controlling the search time window, or they think 'collect' improves search efficiency when it actually adds indexing overhead after the search completes.

Full explanation →

208

MCQmedium

An admin wants to create a dashboard that shows the count of errors by sourcetype over the last 7 days, with the ability to click on a sourcetype to drill down to a detailed search. Which visualization and configuration supports this?

A.Use a line chart and set the 'drilldown' to 'search' in the search command.

B.Use a bar chart and set the 'drilldown' option to 'search' in the dashboard XML.

C.Use a pie chart and set the 'drilldown' option to 'search' in the dashboard XML.

D.Use a table and set the 'link' in search string.

AnswerB

Bar charts compare counts effectively and drilldown is configured in dashboard XML.

Why this answer

Option B is correct because a bar chart is suitable for comparing counts across sourcetypes and allows drilldown via dashboard XML. Option A also supports drilldown but pie charts are less effective for many categories. Options C and D are not optimal or incorrectly describe drilldown configuration.

Full explanation →

209

MCQmedium

Refer to the exhibit. The search results show a large number of hosts, but the `limit=5` only shows the top 5. The eval statement fails with an error. Why?

A.The timechart span should be smaller to avoid too many fields.

B.Eval cannot be used after timechart.

C.The eval statement must use aggregation functions.

D.The field names created by timechart are based on the host names, not `count_1`, etc.

AnswerD

timechart with limit=5 creates fields like `hostname: count`, not generic count_1.

Why this answer

Option D is correct because the `timechart` command in Splunk dynamically creates field names based on the values of the split-by field (in this case, `host`). When you use `timechart count by host limit=5`, the resulting fields are named after the actual host names (e.g., `host1`, `host2`), not generic names like `count_1`. The subsequent `eval` statement fails because it references `count_1`, which does not exist as a field in the results.

Exam trap

Splunk often tests the misconception that `timechart` with a `limit` option creates generic field names like `count_1`, `count_2`, etc., when in reality it uses the actual values from the split-by field as field names.

How to eliminate wrong answers

Option A is wrong because the `span` of the timechart does not affect the number of fields created; it only controls the time bucket size. Option B is wrong because `eval` can be used after `timechart`; the error is not due to a restriction on command order but because the field name referenced in `eval` does not exist. Option C is wrong because `eval` does not require aggregation functions after `timechart`; it can perform row-by-row calculations on existing fields, but the field must exist.

Full explanation →

210

MCQmedium

Refer to the exhibit. The eval command combines two fields into one. What is a potential issue with this search?

A.The eval command may cause syntax errors.

B.Transaction does not allow eval before it.

C.The maxspan should be after the transaction command.

D.If an event has both sessionid and correlation_id, the coalesce may create a new value that does not match other events.

AnswerD

coalesce takes the first non-null; if both fields exist but differ, only one is used, potentially breaking grouping.

Why this answer

Option A is correct because transaction uses the sessionid field for grouping; if both source fields have different values for the same logical session, the transaction will not group them. Option B is false; coalesce works. Option C is false; maxspan is appropriate.

Option D is false; order doesn't matter.

Full explanation →

211

MCQhard

A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?

A.index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip)

B.index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8

C.index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"

D.index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8

AnswerA

Correctly uses `where` with `cidrmatch` and filters by hour.

Why this answer

Option A is correct because it uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.

Exam trap

The trap here is that candidates often assume simple string or inequality operators (like `!=` or `like`) can handle CIDR subnet matching, but Splunk requires the `cidrmatch` function for accurate network range evaluation.

How to eliminate wrong answers

Option B is wrong because `search NOT src_ip=10.0.0.0/8` treats the CIDR notation as a literal string, not a subnet match, so it will not correctly exclude all IPs in the 10.0.0.0/8 range. Option C is wrong because `like "10.%"` is a wildcard pattern match that only catches IPs starting with '10.' but fails to account for the full 10.0.0.0/8 subnet (e.g., 10.0.0.0/8 includes 10.0.0.0 through 10.255.255.255, but '10.%' may miss IPs with different octet patterns or include unintended matches). Option D is wrong because `src_ip!=10.0.0.0/8` uses an inequality operator that compares the IP as a string, not a subnet, so it will not perform CIDR matching and will likely exclude no IPs or produce incorrect results.

Full explanation →

212

MCQmedium

A network operations team uses Splunk to analyze firewall logs. They need to identify top talkers (source IPs with highest total bytes) over the last hour. The current search: 'index=firewall | stats sum(bytes) as totalBytes by src_ip | sort -totalBytes | head 10' takes 5 minutes to complete. They want to make it faster. The environment has 5 indexers with default configurations. The data volume is 100 GB/day. Which action will most improve search performance?

A.Add 'earliest=-1h' to the search to restrict the time range explicitly.

B.Replace head 10 with limit 10 at the end of the pipeline.

C.Use map to run the search per indexer.

D.Set the search's parallelism to 'auto' in the commands.

AnswerA

Limits the data scanned by the indexers from the start.

Why this answer

Option A is correct because explicitly adding 'earliest=-1h' restricts the search to the last hour at the search head level, allowing Splunk to use time-based index metadata to skip irrelevant buckets entirely. Without an explicit time range, Splunk may scan all available data, dramatically increasing I/O and search time. This is the most impactful optimization for time-bound searches over large datasets.

Exam trap

The trap here is that candidates may overlook the most fundamental Splunk optimization—explicit time range—and instead focus on command-level tweaks like 'limit' or parallelism, which have negligible or negative impact on performance.

How to eliminate wrong answers

Option B is wrong because 'head 10' and 'limit 10' are functionally identical in Splunk; 'limit' is simply an alias for 'head' and does not change performance. Option C is wrong because the 'map' command runs a subsearch for each result, which would multiply the workload and degrade performance, not improve it. Option D is wrong because parallelism in Splunk is controlled by the search head and indexers automatically; setting it to 'auto' is the default and does not override the need for a time range restriction.

Full explanation →

213

MCQhard

A Splunk administrator notices that a scheduled saved search `Daily Summary` fails every day at 2:00 AM with the error "Search job expired due to inactivity." The search runs against a large index and takes about 30 minutes to complete. What is the most likely cause?

A.The user who owns the saved search does not have permissions to run it at that time.

B.The indexer has reached its license quota and stops processing.

C.The scheduled search is configured with a time limit shorter than 30 minutes.

D.The search is consuming too much disk space.

AnswerC

Search job expiration occurs when the time limit is exceeded.

Why this answer

The error 'Search job expired due to inactivity' indicates that the scheduled search was terminated before it could complete. In Splunk, saved searches have a configurable time limit (default 10 minutes) that specifies the maximum runtime before the search is killed. Since the search takes 30 minutes, the time limit must be set to less than 30 minutes, causing the premature termination.

Exam trap

The trap here is that candidates often confuse the 'inactivity' error with user permissions or license issues, but it specifically refers to the search job's runtime exceeding the configured time limit in the saved search's dispatch settings.

How to eliminate wrong answers

Option A is wrong because the error message is about job expiration, not permissions; Splunk's role-based access controls do not restrict execution time based on ownership. Option B is wrong because a license quota violation would cause indexing to stop or produce a 'license violation' warning, not a search job expiration error. Option D is wrong because disk space consumption would cause indexing or storage failures, not a search job timeout; the error is specifically about the search job being inactive, not about resource exhaustion.

Full explanation →

214

MCQhard

A transaction search that uses a large maxspan and high-cardinality fields is failing due to memory limitations. Which approach can best reduce memory usage without changing the transaction logic?

A.Use the 'stats' command with values() instead of transaction.

B.Use the 'fields' command before transaction to retain only the correlation fields and _time.

C.Increase the maxpause value to reduce number of open transactions.

D.Set keepevicted=true to offload evicted events.

AnswerB

Correct: minimizes field count.

Why this answer

Option A is correct because using the fields command to retain only correlation fields and _time dramatically reduces memory per event. Option B (increasing maxpause) does not reduce memory. Option C (keepevicted) increases memory usage.

Option D (stats) changes the logic entirely.

Full explanation →

215

MCQeasy

A Splunk admin wants to create a reusable macro that accepts a time range parameter and searches all indexes for events within that range. The macro will be used in dashboards and reports. Which macro definition is correct?

A.define my_search($timerange) [search index=* earliest=$timerange]

B.define my_search($timerange$) search index=* earliest=$timerange$

C.define my_search($timerange$) <search index=* earliest=$timerange$>

D.define my_search($timerange$) [search index=* earliest=$timerange$]

AnswerD

Correct macro definition with proper argument syntax and brackets.

Why this answer

Option A is correct because macros use $arg$ syntax for arguments and the definition must be enclosed in brackets. Option B uses incorrect angle brackets. Option C omits brackets.

Option D uses incorrect dollar sign placement.

Full explanation →

216

MCQhard

An analyst needs to create a time-series chart showing the percentage of total HTTP status codes per day. Which approach is most efficient?

A.timechart count by status | eventstats sum(count) as total by _time | eval pct = round(count/total*100,2) | chart first(pct) over _time by status

B.chart count by status over _time | eval pct = count / sum(count) * 100

C.timechart count by status | addtotals | eval pct = count / total * 100

D.timechart count by status | append [timechart count] | eval pct = count / [| timechart count] * 100

AnswerA

This correctly computes percentages per time bucket and presents them in a time series.

Why this answer

Option A is correct because using timechart to get counts by status, then eventstats to compute total per day, and eval to calculate percentage, is efficient and clear. Option B is incorrect because using chart with a single stats command cannot compute percentages across groups per time bucket. Option C is incorrect because addtotals adds overall totals but does not compute per-day percentages.

Option D is incorrect because overcomplicates with subsearches.

Full explanation →

217

MCQhard

A company has events from multiple data sources that share a common 'request_id'. They want to correlate events from different sources (e.g., web, app, database) into a single transaction per request. However, the timestamps across sources are not synchronized, causing some events to appear out of order. Which approach is best to ensure correct grouping?

A.Use `eventstats count by request_id` to correlate counts

B.Use `sort _time | transaction request_id maxspan=10m`

C.Use `transaction request_id` and rely on Splunk to automatically reorder

D.Use `transaction request_id maxspan=1m` and ignore out-of-order events

AnswerB

Sorting by time ensures events are processed in chronological order, and a 10-minute maxspan accommodates timestamp skew.

Why this answer

Setting a larger maxspan and using `sort _time` before transaction can help reorder events, but the most reliable method is to use `transaction request_id` with a generous maxspan and, if needed, use `sort 0 _time` before transaction to ensure time order.

Full explanation →

218

MCQmedium

A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?

A.Enable 'Alert throttling' based on the 'src' field.

B.Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.

C.Set the 'Throttle' field to suppress alerts for a specified time window.

D.Configure 'Alert severity' to low and set a delay.

AnswerB

This option compares the result set to the previous run and suppresses if unchanged.

Why this answer

Option B is correct: Throttling suppresses alerts if the result count matches a previous condition. Option A is global throttling, not condition-based. Option C and D are not related to result count comparison.

Full explanation →

219

MCQmedium

Refer to the exhibit. What is the purpose of this configuration?

A.It creates a search-time field extraction for clientip and userid.

B.It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.

C.It configures the transaction command to run automatically on all data.

D.It defines a transaction type that can be used in search with `transaction mytransaction` to group events by clientip and userid with given time parameters.

AnswerB

Correct: this defines a named transaction in transaction.conf.

Why this answer

This stanza defines a named transaction type in transaction.conf. It can be invoked in a search as `transaction mytransaction` to group events by clientip and userid with the specified time parameters.

Full explanation →

220

Drag & Dropmedium

Arrange the steps to configure role-based access control in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Roles are configured by setting capabilities and resource access restrictions.

Full explanation →

221

MCQeasy

What is the purpose of an automatic lookup?

A.To automatically validate lookup field names.

B.To automatically update a lookup file when the CSV changes.

C.To automatically create a lookup table from search results.

D.To automatically apply a lookup to events based on a source type or index at search time.

AnswerD

Automatic lookups enrich events transparently when data is indexed or searched.

Why this answer

Option A is correct. An automatic lookup is configured in transforms.conf or props.conf to apply a lookup to events based on sourcetype or index at search time, enriching events without manual lookup command. Option B describes outputlookup.

Option C is not automatic; you need to restart or reload to pick up changes. Option D is not a feature of automatic lookups.

Full explanation →

222

MCQhard

A telecom company monitors call detail records (CDR). Each call has a unique call_id, and events are generated at each network node (setup, ringing, answer, hangup) with timestamps. The events are from different sourcetypes (cdr_setup, cdr_ring, etc.) and are indexed in near real-time. The analyst needs to correlate all events for the same call_id to calculate call duration. The current search is: `index=telecom sourcetype=cdr_* | transaction call_id maxspan=2h`. This search works but sometimes produces huge transactions (100+ events) due to noisy data, causing memory errors. The analyst has identified that each call should have exactly 4 events: setup, ringing, answer, hangup. Which approach would best correlation with minimal resource usage?

A.Use `transaction call_id maxevents=4 maxspan=2h` to limit to exactly 4 events.

B.Use `transaction call_id maxspan=2h` and then filter using `where mvcount(_raw) = 4`.

C.Use `eventstats count by call_id` and then filter.

D.Use `search` with `call_id=*` and then use `streamstats` to calculate duration per call.

AnswerA

Correct: maxevents=4 ensures only the expected events are grouped, reducing memory and processing time.

Why this answer

Option A is correct because setting maxevents=4 limits each transaction to exactly the expected number of events, preventing memory overload from noise data. Option B (filter after transaction) still processes large transactions before filtering. Option C (eventstats) does not preserve time ordering for duration calculation.

Option D (streamstats) does not group all events per call_id correctly.

Full explanation →

223

Matchingmedium

Match each Splunk knowledge object to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines how to extract fields from raw data

Categorizes events based on a search query

Assigns key-value pairs to events for filtering

Maps field values to additional information

Provides a structured, normalized view of data

Why these pairings

Knowledge objects help organize and enrich data in Splunk.

Full explanation →

224

MCQmedium

An analyst uses the following search: `... | timechart span=1h count by status`. What is the purpose of the span argument?

A.It limits the number of status values displayed.

B.It groups events into 1-minute intervals.

C.It sets the time range of the chart.

D.It defines the time interval for each data point (1 hour).

AnswerD

span=1h means each data point aggregates events from a 1-hour window.

Why this answer

Option C is correct. The span argument defines the time interval for each data point in the timechart. Here, span=1h means each bucket represents one hour.

Option A is incorrect because it says 1-minute. Option B is misleading because the time range is set by the search time picker, not span. Option D is incorrect because the 'by' clause handles splitting, not span.

Full explanation →

225

MCQhard

A security analyst wants to find IP addresses that have been involved in both login failures and successful logins within a 5-minute window. Which approach is most efficient?

A.Using the transaction command

B.Using the appendcols command

C.Using a subsearch

D.Using the stats command with values

AnswerA

Groups events by IP within a time span, ideal for this scenario.

Why this answer

Option B is correct because the transaction command groups events from the same IP within a time window, ideal for correlating failure and success. Option A is wrong because subsearches are resource-intensive and not ideal for this correlation. Option C is wrong because stats with values does not guarantee temporal proximity.

Option D is wrong because appendcols requires exact field matching and does not handle time windows.

Full explanation →

Page 3 of 7

All pages

Practice SPLK-1003 by domain

Target a specific domain to shore up weak areas.

Advanced Searching and Statistics Macros, Saved Searches and CIM Advanced Visualization and Lookups Transactions and Event Correlation

See all domains with question counts →